refpolicy/policy/modules/services/tcpd.te

   1
   2 policy_module(tcpd,1.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8 type tcpd_t;
   9 type tcpd_exec_t;
  10 inetd_tcp_service_domain(tcpd_t,tcpd_exec_t)
  11 role system_r types tcpd_t;
  12
  13 type tcpd_tmp_t;
  14 files_tmp_file(tcpd_tmp_t)
  15
  16 ########################################
  17 #
  18 # Local policy
  19 #
  20 allow tcpd_t self:tcp_socket create_stream_socket_perms;
  21
  22 allow tcpd_t tcpd_tmp_t:dir create_dir_perms;
  23 allow tcpd_t tcpd_tmp_t:file create_file_perms;
  24 files_create_tmp_files(tcpd_t, tcpd_tmp_t, { file dir })
  25
  26 corenet_raw_sendrecv_all_if(tcpd_t)
  27 corenet_tcp_sendrecv_all_if(tcpd_t)
  28 corenet_raw_sendrecv_all_nodes(tcpd_t)
  29 corenet_tcp_sendrecv_all_nodes(tcpd_t)
  30 corenet_tcp_sendrecv_all_ports(tcpd_t)
  31 corenet_tcp_bind_all_nodes(tcpd_t)
  32
  33 fs_getattr_xattr_fs(tcpd_t)
  34
  35 # Run other daemons in the inetd child domain.
  36 corecmd_search_bin(tcpd_t)
  37 corecmd_search_sbin(tcpd_t)
  38
  39 files_read_etc_files(tcpd_t)
  40 # no good reason for files_dontaudit_search_var, probably nscd
  41 files_dontaudit_search_var(tcpd_t)
  42
  43 libs_use_ld_so(tcpd_t)
  44 libs_use_shared_libs(tcpd_t)
  45
  46 logging_send_syslog_msg(tcpd_t)
  47
  48 miscfiles_read_localization(tcpd_t)
  49
  50 sysnet_read_config(tcpd_t)
  51
  52 inetd_domtrans_child(tcpd_t)
  53
  54 optional_policy(`finger.te',`
  55         finger_domtrans(tcpd_t)
  56 ')
  57
  58 optional_policy(`nis.te',`
  59         nis_use_ypbind(tcpd_t)
  60 ')
  61
  62 optional_policy(`portmap.te',`
  63         portmap_udp_sendto(tcpd_t)
  64 ')
  65
  66 optional_policy(`rlogin.te',`
  67         rlogin_domtrans(tcpd_t)
  68 ')
  69
  70 optional_policy(`rshd.te',`
  71         rshd_domtrans(tcpd_t)
  72 ')